I've got iptables set up like this:

# iptables -L -nv
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
13925 8291K ACCEPT     all  --  lo     *  
    0     0 ACCEPT     all  --  *      *              state RELATED,ESTABLISHED
 8153 2431K ACCEPT     tcp  --  *      *              multiport dports 22,25,53,80,443
  482 98621 DROP       all  --  *      *  

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 5057 3382K ACCEPT     all  --  *      *  

But I can't make requests from this machine. DNS, HTTP, anything I initiate from this machine fails. Incoming traffic is still fine, SSH and Web Server are still accessible from outside. If I change my input policy to ACCEPT (and remove that last DROP rule, which is just there for testing) everything works. It looks like no incoming ESTABLISHED/RELATED traffic is coming through, notice the zeros at the beginning of that line. What have I done wrong?

  • 1
    Have you got the conn track modules loaded? lsmod | grep conntrack
    – fukawi2
    Jul 22 '13 at 23:46
  • Check to see if you have any rules in the other tables using the NOTRACK target. iptables -t raw -vnL, -t mangle, -t nat, -t security. Jul 24 '13 at 21:37
  • I had to ask my vps provider to enable conntrack on my vps... it works now.
    – Jay K
    Oct 11 '13 at 18:59

Connection tracking isn't working for you, for some reason (as evidenced by the fact that not a single packet was disposed of by your conntrack-based rule in input). This is because you have set NOTRACK somewhere (the only place this is allowed is the raw table, so do iptables -t raw -nvL), or because you don't have the conntrack module loaded in your kernel, or you have disabled it some other way. You could validate this by setting a rule like this:

iptables -t filter -I INPUT 1 -m conntrack --ctstate UNTRACKED -j LOG

This will give you packet counters for all the packets not being tracked at all by conntrack (without affecting anything else). Don't leave this on for too long as it does send data to the syslog (but it's the best choice for a non-dispositive rule in this case).

I don't believe iptables will allow you to specify conntrack-based rules without conntrack being loaded, but you can validate this anyway by doing an lsmod | grep conntrack and looking for these modules:


Otherwise you might have a kernel bug or something.

It's also worth mentioning that typically DNS queries are made over udp/53, not tcp/53. However, your rule to accept related,established packets in input should take care of your DNS querying needs.

  • Marking as correct answer since I needed to get conntrack installed.
    – Jay K
    Oct 15 '14 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.